Política de privacidad

The data controller for the personal data processed through supacar is IDEC APPS S.L., CIF B02687416, with registered address at Las Morerillas 5, 41701 Sevilla, España ("IDEC APPS", "we", "us"). You can reach us about any privacy matter at support@idecapps.com.

We collect:

• Account data — name, email address and encrypted credentials, managed through Supabase Auth.
• Billing data — handled by Stripe; we never see or store full card numbers.
• Content data — the vehicle photos you upload and the images the Service generates, together with the prompts and edit history associated with them.
• Team data — roles and membership if you use a team account.
• Technical data — IP address, browser and device information, and the essential cookies described in our Cookie Policy.

We process this data to:

• provide the Service, including generating and storing your images (performance of our contract with you);
• secure the platform, prevent abuse and enforce our Terms of Service (legitimate interest);
• issue invoices and comply with tax and accounting obligations (legal obligation); and
• send product updates, only if you opt in (consent, which you can withdraw at any time).

Uploaded photos and the images generated from them are processed only to deliver the edits you request. We do not use your images to train public or third-party models, and we do not sell your images or data to anyone. Images remain in your library until you delete them or close your account.

We rely on a small number of specialist providers, each bound by a data processing agreement and instructed to use your data only to provide their service to us:

• Supabase — database, authentication and file storage, hosted on AWS infrastructure.
• Google (Gemini API) — AI processing of images to generate the requested edits.
• Stripe — payment processing and invoicing.
• Vercel — hosting and content delivery for the web application.

Some of these providers may process data outside the European Economic Area (for example, in the United States). Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We keep account and billing data for as long as your account is active and for as long afterwards as required by Spanish tax and accounting law (generally up to six years for invoices). Uploaded and generated images are kept until you delete them or close your account; once you request deletion, we remove the underlying files from active storage within 30 days, subject to any shorter or longer period required by law or by our backup cycle.

Under the GDPR and Spanish data-protection law (LOPDGDD) you can ask us to access the personal data we hold about you, rectify inaccurate data, erase your data ("right to be forgotten"), restrict or object to certain processing, and receive a copy of your data in a portable format. To exercise any of these rights, email support@idecapps.com; we will respond within the timeframes required by law. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) if you believe your rights have not been respected.

We use encryption in transit and at rest, access controls limited to what each team member needs, and our subprocessors' own security certifications to protect your data. No system is completely secure, and we will notify you and the relevant authority of any breach as required by law.

supacar only uses essential cookies needed to keep you signed in and to keep the Service secure — see our Cookie Policy for details.

supacar is a business tool intended for dealerships and automotive professionals and is not directed at, or knowingly used by, individuals under 16.

We may update this Privacy Policy as the Service evolves. We will post the updated version here and, for material changes, notify you by email.

This policy is governed by Spanish law.